How to onboard data more than 30days on Security Essentials

[gent79]

Hi,

I am trying to ingest botsv2 and botsv3 indexed data into security essentials for demo and learning purposes, but the onboarding background search only checks the data in the last 30 days, the two types of BOTs datasets are about 6 years ago,  I want to know how to modify such onboarding search to expand its search time?

[marnall]

You can go to Searches, Reports, and Alerts, then set the App to be Splunk Security Essentials. If you set the Owner to All, you can then see all of the included Searches in the app. If one of them is scheduled, you can set its time range and schedule, so that it will onboard data from long ago in a single swoop.

Did you do anything in the app interface to activate the "onboarding background search?"